> ## Documentation Index
> Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Traefik ingress routing visibility

> Trace Traefik in Radar: IngressRoute to Middleware to Service routing paths in topology, plus IngressRoute and Middleware detail views with secrets redacted.

[Traefik](https://traefik.io/) is a modern reverse proxy and ingress controller for Kubernetes, with dynamic configuration, middleware chains, and advanced traffic management via CRDs.

### What Radar Shows

**Topology:** Full Traefik routing path  -  IngressRoute → Middleware → Service (or TraefikService → Service) with TLS and transport configuration edges. See how traffic flows from entrypoints through middleware chains and weighted/mirroring TraefikServices to backend Kubernetes Services. Both **Resources** and **Traffic** view modes are supported.

**IngressRoute / IngressRouteTCP / IngressRouteUDP Detail View:**

* Entry points and TLS configuration (secret, cert resolver, TLS options/stores)
* Route match expressions with priority and kind badges
* Per-route services with port, weight, and ServersTransport links
* Per-route middleware references with cross-namespace indicators
* Aggregated middleware chain with numbered ordering
* Alert banners for no-route or no-service configurations

**Resource Browser:** Smart columns show entry points, hosts (extracted from match expressions), route summaries, TLS status, and middleware counts. All 10 Traefik kinds have dedicated table columns  -  Middleware shows type, TraefikService shows type and targets, ServersTransport shows insecure/serverName, TLSOption shows min TLS version.

**Middleware / MiddlewareTCP Detail View:** type-aware rendering  -  `chain` links its member middlewares, auth middlewares (basicAuth/digestAuth/forwardAuth) show **secret references only, never values**, `errors` shows its service and status mapping, and unknown/plugin types fall back to a key/value view with nested credential keys redacted.

**TraefikService Detail View:** weighted backends with weight bars, mirroring (primary plus mirrors with percentages), and the load-balancing strategy.

**TLSOption Detail View:** minimum/maximum TLS versions, cipher suites, and client-auth configuration.

**ServersTransport / ServersTransportTCP Detail View:** SNI, an `insecureSkipVerify` warning banner, CA/client-cert secret references, and timeouts.

**Secret safety:** inline credentials in a Traefik CRD spec are redacted in the AI/MCP context (`get_resource`)  -  credential keys and high-confidence secret patterns are masked  -  and the Middleware detail renderer shows secret *references* only, never values. Reference names (`secretName`, `basicAuth.secret`, `rootCAsSecrets`) are preserved so you can still diagnose a bad reference. The raw YAML view still shows the object as stored in the cluster.

### Cluster Audit checks

Traefik ships no admission webhook or linter, so a typo'd reference is accepted silently and the route or middleware just doesn't do what you wrote. Radar's Cluster Audit catches the common dangling-reference cases as **Reliability** checks:

| Check                           | What it catches                                                                       |
| ------------------------------- | ------------------------------------------------------------------------------------- |
| `traefikRouteMissingService`    | An IngressRoute referencing a Service or TraefikService that doesn't exist            |
| `traefikRouteMissingMiddleware` | An IngressRoute referencing a Middleware that doesn't exist                           |
| `traefikChainMissingMiddleware` | A `chain` Middleware listing a member Middleware that doesn't exist                   |
| `traefikErrorsMissingService`   | An `errors` Middleware whose `errors.service` references a Service that doesn't exist |

These checks are **inventory-authoritative**: a "missing X" finding is asserted only when that target kind is served by a cluster-wide synced informer, so a namespace-scoped (RBAC-limited) cache skips the check rather than fabricating a false positive. Matching is group-aware  -  a `traefik.io` reference is not satisfied by a `traefik.containo.us` object  -  and cross-namespace references resolve correctly.

### Supported CRDs

| CRD                 | Group                 | Topology | Detail View | AI Summary |
| ------------------- | --------------------- | -------- | ----------- | ---------- |
| IngressRoute        | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| IngressRouteTCP     | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| IngressRouteUDP     | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| Middleware          | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| MiddlewareTCP       | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| TraefikService      | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| ServersTransport    | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| ServersTransportTCP | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| TLSOption           | `traefik.io/v1alpha1` | Yes      | Yes         | -          |
| TLSStore            | `traefik.io/v1alpha1` | Yes      | Generic     | -          |

The legacy `traefik.containo.us` API group (pre-v2.11) is warm-listed alongside `traefik.io` so older clusters don't pay first-list latency.